CodeIgniter is vulnerable to improper authentication via Session Handlers
CVE-2022-46170

8.6HIGH

Key Information:

Vendor

Codeigniter4

Status
Codeigniter4
Vendor
CVE Published:
22 December 2022

What is CVE-2022-46170?

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to DatabaseHandler, MemcachedHandler, or RedisHandler, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CodeIgniter4 < 4.2.11

References

https://github.com/codeigniter4/CodeIgniter4/security/adv...
x_refsource_CONFIRM
https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6...
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.